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Suppose one wants to certify that a quantum channel is not entanglement-breaking. I consider all 
four combinations of trusted and untrusted devices at the input and output of the channel, finding 
that the most interesting is a trusted preparation device at the input and an untrusted measurement 
device at the output. This provides a time-like analogue of EPR-steering, which turns out to reduce 
to the problem of joint measurability, connecting these concepts in a different way to other recent 
work. I suggest a few applications of this connection, such as a resource theory of incompatibility. 
This perspective also sheds light on why the BB84 key distribution protocol can be secure even with 
an untrusted measuring device, leading to an uncertainty relation for arbitrary pairs of ensembles. 


The crucial distinction between separable and entan¬ 
gled quantum states has its analogue in the notion of an 
entanglement-breaking channel mm- An entanglement¬ 
breaking channel C can be thought of as measuring a 
POVM {Ex} on the input system, transmitting the clas¬ 
sical information A, and then preparing an element of the 
set of states {px} on the output system, so that 

C{p)=Y,MExp)px. ( 1 ) 

A 

Verifying the entanglement of a quantum state with 
various levels of trust is now a well-studied topic. In the 
bipartite case, there are three main possibilities. Most 
commonly both parties are trusted, allowing state to¬ 
mography and/or the use of entanglement witnesses. In 
the other extreme, neither party is trusted, so that one 
must resort to testing Bell inequalities mm- The inter¬ 
mediate case where one party is trusted is known as the 
EPR-steering scenario [5], where one can test steering 
inequalities [5]. 

Since a channel is entanglement-breaking if and only if 
it gives a separable state when applied to half of a max¬ 
imally entangled state, the problem of verifying that a 
channel is not entanglement-breaking could be reduced to 
the above possibilities. However that requires the ability 
to prepare entangled states, and if any devices are un¬ 
trusted it requires parties at space-like separation. Here 
I focus on the situation where there are just two parties, 
Alice who prepares quantum systems and inputs them 
entirely into the channel, and Bob who performs mea¬ 
surements solely on the output of the channel. Assuming 
that the channel is realisable and non-trivial, Bob’s ac¬ 
tions must be in the future of the Alice’s, ruling out the 
possibility of space-like separation. 

In this setup there are now four situations, one more 
than in the bipartite entanglement case due to the lack 
of Alice-Bob symmetry in the setup: untrusted Alice and 
trusted Bob is fundamentally different from trusted Alice 
and untrusted Bob. After a brief discussion of all four 
cases, I will focus on trusted Alice and untrusted Bob. 
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Perhaps unsurprisingly, this bears a close resemblance 
to the EPR-steering scenario. But it turns out to boil 
down to the well-known problem of joint measurability 
of POVMs. Steering and joint measurability have already 
been found to be closely connected: lack of joint measur¬ 
ability is necessary and sufficient for the measurements to 
enable violations of steering inequalities mi- Here the 
natural translation of the steering scenario from states to 
channels reveals a connection that is perhaps even closer: 
the translated concept of steering is lack of joint measur¬ 
ability. 

I outline a few translations enabled by this connec¬ 
tion. For example, the resource theory of steering laiin] 
is easily adapted into a resource theory of measurement 
incompatibility. Building on m, it also gives a more 
transparent and general understanding of why the BB84 
key distribution protocol |12] is secure with an untrusted 
measuring device. 

The basic idea of this paper is implicit in the recently 
defined notion of “channel steering” m, being the spe¬ 
cial case when (in the notation of [13]) B’s output is triv¬ 
ial, just like channel steering reduces to standard EPR- 
steering when C’s input is trivial. Hence all of the results 
of [IS] apply here. Nevertheless I think this special case 
is interesting enough to merit specific investigation, and 
that this lends further support to the definition of chan¬ 
nel steering chosen in m- 

I. THE FOUR SCENARIOS 

The most familiar scenario is when both Alice and Bob 
are trusted. Then Alice can use an informationally com¬ 
plete set of preparations, and Bob an informationally 
complete set of measurements, to together reconstruct 
C. This is known as process tomography M- One can 
then use standard tools from entanglement theory |15j 
to check whether C is entanglement-breaking (or equiva¬ 
lently [2], if the Choi isomorphic state [TB] is separable). 

Now consider the case that Alice has an untrusted 
preparation device. She chooses a classical label x and 
then the device inputs an unknown state px into the 
channel. Since Bob’s devices are still trusted he can 
do state tomography to determine the resulting output 
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states px = C{px)- But whatever he sees could always 
have come from the entanglement-breaking channel 

C{p) = '^Px{x\p\x) ( 2 ) 

X 

provided Alice’s device simply encodes x in the orthonor¬ 
mal basis {|x)}. 

When compared to the standard steering scenario, the 
key difference is that there is no way to rule out Alice’s 
choice X from being transmitted to Bob, because the very 
thing we are testing is a channel from Alice to Bob. (Note 
that, by considering a more elaborate scenario, an anal¬ 
ogy with steering can be obtained wherein an untrusted 
party acts before a trusted one ini) 

If we extend our distrust of Alice to encompass Bob, 
then we have strictly less information, namely just prob¬ 
abilities p{b\x,y) = TT:(Ei,\yC{px)) from inputting a set¬ 
ting y and receiving an outcome b from Bob’s device that 
implements unknown POVMs Since we can sim¬ 

ulate any C{px) with an entanglement-breaking channel, 
this can be extended to p{h\x^y). In fact it is trivial to 
produce any p{h\x, y) whatsoever: Alice encodes x in the 
{jx)} basis, the channel is C[p) = J2x 1^) (^1 P 1^) (^l> 

Bob measures the POVM ?/) k) (^ll- (Again, 

with more background assumptions, a “time-like” ana¬ 
logue to Bell inequalities was obtained by Leggett and 
Garg m- Similarly to the issue here of Alice’s setting 
being sent to Bob, the Leggett-Garg scenario allows “sig¬ 
nalling in time” [19] that weakens the analogy to the Bell 
scenario.) 

Last but not least, the final possibility is a trusted Alice 
and an untrusted Bob. Using a informationally complete 
set of preparations {px}, we can reconstruct the POVM 
Ah|y = C^Ei,\y) that Bob’s POVMs E^y induces on the 
input of C. If C is an entanglement-breaking channel then 
its adjoint is, by eq. Q 

Ct(ii;) = ^AATr(ApA), (3) 

A 

SO that 

Eb\y = '^Exp{b\y,X), ( 4 ) 

A 

where p{b\y,X) = Tr^E^ypx). Conversely any Ei,\y of 
the form eq. can be achieved by the entanglement¬ 
breaking channel C{p) = | A) (A| provided 

Bob measures the POVM {J2xPi^\yj |A) (A|}. 

Readers familiar with the EPR-steering scenario laEi 
[20] will notice the resemblance of eq. Q to the basic 
dehnition of a set of sub-normalized steered states {(Jh\y} 
that are compatible with a separable state, known as an 
“unsteerable assemblage”: 

'^blv = '^PWcrxpibly, A), (5) 

A 


Alice 

Bob 

General data 

Classical data 

Good 

Good 

Ghannel C 

C(-) = EATr(EA-)PA 

Good 

Bad 

Induced POVMs {Ei,\y} 

Eb\y = Y.xExp{b\y,X) 

Bad 

Good 

Output states {px} 

All (but see |17|i 

Bad 

Bad 

Probabilities {p(h\x,y)} 

All (but see [TH]) 


TABLE I. Summary of the four possible combinations of 
trusted (“good”) and untrusted (“bad”) devices at Alice’s in¬ 
put and Bob’s output. The “general data” column lists what 
can be determined in the scenario, with “classical data” being 
the form compatible with an entanglement-breaking channel. 

where the quantum states ax are known as “local hidden 
states”. Indeed if we absorb p{X) into ax = p{X)ax then 
we have 

<Xb\y = '^^xP{b\y,X), ( 6 ) 

A 

so that the only difference with eq. Q is that 
Tr(a-A) = 1 whereas X)a Ex = I- 

By analogy we might call {E\} a “local hidden POVM” 
and the corresponding {Eh^y} unsteerable (the latter be¬ 
ing somewhat counter-intuitive terminology since Bob 
has to act after Alice). But in fact there is no need 
for new terminology because eq. Q is just the statement 
that the {E^y} are jointly measurable (i.e. the fixed 
POVM {Aa} is sufficient to reproduce all of the measure¬ 
ments using the classical post-processing {p{b\y,X)}). 

The four scenarios are summarised in table H] From 
now on the focus will be a trusted Alice and untrusted 
Bob. The discussion of this case above is summarised by 

Theorem 1. A channel from a trusted Alice to an un¬ 
trusted Bob can be shown not to be entanglement-breaking 
if and only if the measurements Bob induces on the input 
to the channel are not jointly measurable. 

As noted in the introduction, this scenario is a special 
case of channel steering [T3], so that the above result is 
a special case of [l3]’s Proposition 1. Similarly, Theorem 
8 of [13] specialises to 

Theorem 2. A channel C allows Bob to induce incom¬ 
patible measurements at Alice’s input if and only if the 
corresponding Choi state pab allows Bob to steer Alice. 

In other words, a trusted Alice and untrusted Bob can 
certify that C is not entanglement-breaking in the present 
“time-like” scenario if and only if they could certify that 
PAB is entangled in the standard “space-like” scenario. 

II. SIMPLE TRANSLATIONS BETWEEN 
EPR-STEERING AND JOINT MEASURABILITY 

In the usual EPR-steering scenario an assemblage may 
happen to satisfy (i-®- Alice’s reduced 

state is maximally mixed). In this case we can simply 
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rescale the assemblage to a set of POVMs Ef,\y = dab\y 
Comparing eq. Q with eq. ([6) we see that {Eb\y} will 
be jointly measurable if and only if {cri,\y} is unsteerable. 
This connection allows for the translation of some results 
between scenarios, particularly existence results. 

It was already noted in [8] that EPR-steering inequal¬ 
ities and joint measurability inequalities are closely re¬ 
lated. The scaling argument makes this particularly 
transparent in the case of a linear EPR-steering inequal¬ 
ity which is a set of Hermitian operators Fb\y such 
that 

'^Tr{Eb\y(7b\y) < L (7) 

b,V 

for all unsteerable assemblages {crb\y}. Since a jointly 
measurable {Eb\y} is d times an unsteerable assemblage, 
we must have 

^ i:v{Fb\yEb\y) < dL (8) 

b,y 

for all jointly measurable {Eb\y}. Similarly, since an in¬ 
compatible {Eb\y} is d times a steerable assemblage, and 
all steerable assemblages violate a linear EPR-steering 
inequality [S], all incompatible {Eb\y} will violate a lin¬ 
ear joint measurability inequality obtained through this 
translation. 

Eor example, the simple steering inequality given as 
Eq. (63) in [6] gives the joint measurability inequality 

Tr (^(Eiii - £; 2 |i) + r(Ei |2 - i? 2 | 2 )) < 2^2 (9) 

for two binary qubit POVMs {Eb\i} and {Eb\ 2 }, where 
X and Y are Pauli matrices. 

Perhaps the most important fact about EPR-steering 
is that there are bipartite entangled states that never¬ 
theless do not exhibit steering under projective measure¬ 
ments. The classic example [5], based on a model by 
Werner m, involves maximally mixed reduced states. 
Hence they can be translated into examples of non¬ 
entanglement breaking channels where nevertheless pro¬ 
jective measurements by Bob can only induce jointly 
measurable POVMs on the channel input. The simplest 
example would be the qubit channel 

Cp{p) = PP + {I - p)^- (10) 

Translating lain] we see Cp is entanglement-breaking 
if and only if p < whereas projective measurements on 
the output induce jointly measurable POVMs on the in¬ 
put whenever p < ^ (and the non-entanglement-breaking 
can be verified with untrusted Bob whenever p > 1). 
Very recently [H] it was noticed that a model by Barrett 
[23j can be adapted to show, in this scenario, that all 
POVMs on the output induce jointly measurable POVMs 
on the input whenever p < ~ 0.41. 

As an example in the opposite direction, consider 
structures of joint measurability. Briefly, for a finite set 


of measurements M = {Mi ,..., M„}, the joint measur¬ 
ability structure is given by listing all of the (maximal) 
subsets of M that are jointly measurable. The extreme 
cases are {M{, meaning that all the measurements can 
be measured together, and {{Mi},..., {M„}}, meaning 
that every pair of measurements is incompatible. A re¬ 
cent result Pl] states that any such structure can be 
realised in (Hnite-dimensional) quantum theory. Trans¬ 
lating (i.e. dividing everything by d), we see that the 
corresponding structures of unsteerability in the EPR- 
steering scenario are also as rich as possible. Eor example, 
there is a three-settings assemblage that is steering even 
though the sub-assemblage consisting of any pair of set¬ 
tings is unsteerable - the EPR-steering equivalent of the 
so-called Specker’s scenario PSJ PHj in which three mea¬ 
surements cannot all be jointly measured, even though 
any pair of them can. 

However, the scenarios are not isomorphic, and so not 
every statement that is natural in one scenario will trans¬ 
late to a statement that is natural in the other. For 
example, any pair of two-outcomes measurements {Eb\y{ 
that are not jointly measurable can be used to violate the 
CHSH P7] inequality by choosing an appropriate bipar¬ 
tite state and pair of measurements {Ea\x} for the other 
party [28] . In the EPR-steering scenario one might there¬ 
fore wonder if any steerable two-setting two-outcome as¬ 
semblage {(Jb\y} can be used to violate the CHSH in¬ 
equality by choosing an appropriate {Ea\x\ to form the 
probabilities TT{Ea\xO'b\y), at least when 
In fact a direct translation of [55] doesn’t establish this 
because there is nothing to play the role of the bipar¬ 
tite state (which in general does not have a maximally 
mixed reduced state and is therefore not isomorphic to a 
channel). An explicit example of a steerable two-setting 
two-outcome qubit assemblage (with <Jb\y = 1/2) that 
fails to violate the CHSH inequality is 


ai|i = 0.3|0) (0|, 

(11) 

(7211 = 0.2 |0) (0|+0.5|1)(1|, 

(12) 

cri|2 = 0.3 |-|-) (-|-| , 

(13) 

o’2|2 = 0.2 |-|-) (-f 1 -1- 0.5 |—) (—1. 

(14) 


Using semi-definite programming is easy to check that 
this assemblage is steering and yet the optimum {Ea\x} 
give a value for CHSH’s expression of approximately 1.7, 
which satisfies the local upper bound of 2. Another way 
of stating this fact is that “choosing an appropriate bi¬ 
partite state” is essential to the result of |55| , one cannot 
simply use a maximally entangled state for any pair of 
measurements. 


III. THE RESOURCE THEORY OF 
MEASUREMENT INCOMPATIBILITY 

Most of our quantitative understanding of entangle¬ 
ment |15j comes from thinking of it as a resource theory: 
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allowing local operations and classical communication for 
free, how ‘useful’ is a given multipartite quantum state 
(the basic objects of the theory)? Recently, to under¬ 
stand how best to quantify steering png, a similar “re¬ 
source theory of steering” m has been developed. 

In the resource theory of steering, the free operations 
are local quantum operations by the trusted party, local 
classical operations on the input and output of the un¬ 
trusted party, and one-way classical communication from 
the trusted to the untrusted party. 

This translates naturally into a resource theory of mea¬ 
surement incompatibility. The basic objects are sets of 
POVMs {E^y}. The free operations, which might be 
called compatibility non-decreasing operations (CNDO) 
consist of prepending these POVMs with a fixed quan¬ 
tum instrument {Ca}, classically processing the new in¬ 
put y' along with a into a new choice y from amongst 
the original POVMs, and classically processing outcome 
6, along with (a, j/', y), into a new output as in fig. 
The requirement that the initial quantum instrument is 
fixed (i.e. independent of y'), is equivalent to the restric¬ 
tion that the untrusted party cannot send messages to 
the trusted party in the resource theory of steering. 

What are the “free resources” in this theory, analogous 
to the separable states in entanglement theory? We will 
now see that they are simply jointly measurable POVMs. 
We can turn an arbitrary input set of POVMs {E^y} into 
an arbitrary set of jointly measurable POVMs {Fi\y} by 
prepending the joint measurement, feeding an arbitrary 
state into {E^y} and ignoring the output, and then clas¬ 
sically processing the output of the joint measurement 
to obtain the appropriate output b for a given input y. 
On the other hand, if we start with a jointly measur¬ 
able POVM {E^y}, the CNDO can only give us another 
jointly measurable POVM {E^y} because prepending the 
joint measurement of {E^y} with the fixed quantum in¬ 
strument gives us a joint measurement of {F^y}. 

Incompatible POVMs are then a resource: for exam¬ 
ple, for any such POVMs there exist entangled states 
for which the POVMs would demonstrate EPR-steering 
[HIS]. In the scenario considered above, any incompatible 
POVMs can be used by an untrusted party to show that 
they are receiving a non-entanglement-breaking channel 
from a trusted party, at least in the case of a unitary 
channel (whose adjoints, which are also unitary chan¬ 
nels, always map incompatible POVMs to incompatible 
POVMs). 

The main results of [10] translate into results about 
measurement incompatibility. For example, in analogy 
with the “steerable weight” we can define the “incom¬ 
patible weight” of a set of POVMs {Ei,\y} as the smallest 

> 0 such that 

Fh\y (1 ^)^&|y (^^) 

for arbitrary POVMs {Fy^y} and jointly measurable 
POVMs {Gb\y}. Evidently the incompatible weight is 
zero if and only if the {E^y} are jointly measurable, and 
an argument similar to Appendix D of m shows that 


it is non-increasing under CNDO and can therefore be 
called an “incompatibility monotone” [30] . 

As another example, in appendix [^ it is argued that 
Theorem 4 of m gives 

Theorem 3. Suppose {E^y} and {^ 61 ^} are both pairs of 
distinct non-trivial two-outcome projective measurements 
on a qubit. Then the first can be converted into the second 
by CNDO if and only if it can be converted by simply 
prepending a unitary. 

Compare the pair of measurements defined by the 
eigenstates of X and Z with the pair defined by X and 
Vl — eV -I- yJeZ for small e > 0. Since the second pair 
would be jointy measurable for e = 0, one might think 
that the first pair is “more incompatible” than the sec¬ 
ond. But since the above theorem tells us that neither 
pair can be converted to the other by CNDO, there not 
only exists an incompatibility monotone that assigns a 
higher value to the first than the second, but also an¬ 
other monotone that does vice versa. [3g 

IV. QUANTUM KEY DISTRIBUTION 

An entanglement-breaking channel as in eq. Q can 
trivially be extended to give additional parties the same 
access to Alice’s input as Bob has, for example 

C'(d) = X! Tr(EAp)pA O P\- (16) 

A 

However, channels which are not entanglement-breaking 
have limits on such extendibility, giving a channel ana¬ 
logue to the monogamy of entanglement m- Hence a 
necessary condition for the security of a “prepare and 
measure” quantum key distribution protocol is that Al¬ 
ice and Bob verify that the channel between them is not 
entanglement-breaking. 

From the analysis of section |l| we therefore see 
that prepare-and-measure key distribution is impossible 
with completely untrusted preparation devices (although 
rather weak forms of trust can suffice [3^). But since the 
non-entanglement-breaking property can be verified with 
an untrusted measuring device, it is plausible that quan¬ 
tum key distribution is possible in this scenario. 

A. BB84 

For example, the parties in the BB84 protocol [ig 
are doing everything needed to verify a violation of the 
joint measurability inequality eq. (with Z in place 
of Y). And indeed security proofs for the BB84 proto¬ 
col have been provided for this scenario [IS ISM], with 
the distrust of Bob’s devices emphasized particularly in 
m l40l l4T] . This type of scheme was dubbed “one¬ 
sided device independent quantum key distribution” in 
Ea, and entanglement-based versions were shown to rest 
upon EPR-steering. 



5 



I—>-CNDO 



FIG. 1. A compatibility non-decreasing operation (CNDO) transforms a set of POVMs {Ef,^y} into a set {Fy^yi} enclosed in 
the grey box (cf. figure 1 of |10p. Inside the box there is a fixed quantum instrument {Ca} and classical conditional probability 
distributions p{y\a,y') and p{b'\b,a,y',y). Solid lines carry quantum systems, dashed lines indicate classical information. 


The analyses [HI [40l ST] are all based on considering 
equivalent entanglement-based protocols, following jHj. 
A more direct approach, along the lines pursued in earlier 
works [3M38] and more recently in (42] SS] , may add con¬ 
ceptual clarity, as well as enabling consideration of cases 
where the average state prepared by Alice depends on 
her choice of basis, which would violate the no-signalling 
principle in the entanglement-based scenario but is per¬ 
fectly possible in an experiment where the states are 
prepared directly. (Although such cases can also be ad¬ 
dressed using different entangled states for each of Alice’s 
bases, as in, for example, [39|.) 

The analyses of m can fairly straightforwardly be 
adapted to apply directly to the “prepare and mea¬ 
sure scenario” we are considering. They are based on 
“monogamy of entanglement games”, which are defined 
by n POVMs {E^\g} for Alice. Bob and Charlie then 
choose a state pabc and POVMs {F^^g} and {Gx\g} with 
the aim of maximizing quantities such as 

Pwin = ^ X/ ® ® Gy.^g)pABc) ■ (17) 

9,x 

When considering key distribution, the eavesdropper 
would choose pabc and have full control of Charlie. 

Translating to the present scenario, a game would be 
defined by n ensembles {px\e} for Alice. Bob and Charlie 
would then choose a channel C from A to BC and POVMs 
as before with the aim of maximizing quantities such as 

7’™ ^ ^ X! ® Gxlff)C(px;lg)) . (18) 

9,x 

For an intuitive idea of the connection between such a 
game and key distribution, suppose a game is such that 
Pwin is bounded away from 1. Then if, whichever ba¬ 
sis 0 is announced by Alice, Bob’s POVM F^jg is able 
to recover Alice’s bit x perfectly, it must be that Char¬ 
lie’s POVM cannot also recover it perfectly. In other 


words, the strength of the correlation between Alice and 
Bob’s copy of x provide limits anybody else’s access to 
X. The assumption that C is independent of 0 must be 
enforced by Alice keeping 0 secret until Bob’s output sys¬ 
tem is in his custody. Since the BB84 protocol is based 
on Alice preparing random eigenstates of Z and X, it 
will be related to the “BB84 game” po|o = |0) (0| /2, 
Pi|o = |1) (1| /2, Poll = 1+) (+1 /2, Pi|i = |-) (-| /2. 

With minor modifications, outlined in appendix 
the main results of m can be translated to this type 
of game. In particular, this should facilitate the study 
of prepare-and-measure protocols that cannot be con¬ 
verted into entanglement-based protocols because of the 
no-signalling issue discussed above. It also provides 
an interesting type of uncertainty relation. Fix some 
pair of ensembles {px\{)\ and {px\i\ on a d-dimensional 
Hilbert space A. For a given channel C from A to BC, 
we can define Pguess(V|i30) to be the optimum prob¬ 
ability of guessing x given Ttc(C{px\ 0 )), averaged over 
the uniformly random choice 0 of ensemble. Similarly 
Pguess(A'|C'0) denotes the optimum probability of guess¬ 
ing x given TTB{C[Px\e))- A result of [TT] can then be 
translated into the statement that for all C, 


Pguess(A:|B0) -f Pguess(A:|C'0) < d{m + y/c), (19) 


where the two ensembles {px\e} are characterized by 

2 

c = maxx^z y/pAfl^/pAp and m = maxa;,e Tr(pa;|e). 
Note that rather than the usual two incompatible mea¬ 
surements on some state, this uncertainty relation is 
about two ensembles {pa;|o} and {Px\i\ on A being fed 
into some channel to BC. Such uncertainty relations 
have been considered before, for example Corollary 6 
of US), and Uni- However those works use an equiva¬ 
lence to the usual measurement uncertainty scenario that 
only works if Y.xPx\o = Y.xPx\i- By contrast, |42| pro¬ 
vided a similar type of uncertainty relation (called there a 
“cloning bound”) without this limitation. Equation (19) 
shares this feature. 
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B. B92 

Another interesting prepare-and-measure key distribu¬ 
tion protocol was proposed by Bennett [47j . It is in some 
sense “minimal” in that Alice chooses between prepar¬ 
ing just two (without loss of generality, qubit) states 
\'4>i) and |' 02 ), which can be arbitrary non-orthogonal 
pure states. Bob is supposed to choose between mea¬ 
suring either {Ei\i,E 2 \i} = {I - |'02) (V’ 2 |, IV’ 2 ) {'^ 2 ]} or 

{^^i|2,^^2|2} = {I - IV’i) (Vil, IV'i) (V'll}- 

Suppose that Bob’s measuring devices are untrusted. 
Let us examine what we can learn about the measure¬ 
ments Eii\y he induces on Alice’s input. If we find that 
for i 7 ^ j, {'il)j\Ei\^\ijjj) = 0, then Aq, < I - |V’j) (r/>j|. If 
this is all we verify then the eavesdropper may be unam¬ 
biguously discriminating 0115] between the and 
then giving Bob’s measuring device classical instructions 
to output I for the Ei\i measurement if the eavesdropper 
has determined that the state is not |^i), and 2 oth¬ 
erwise. This is similar to the standard attack on Ben¬ 
nett’s protocol in the presence of losses, except that the 
eavesdropper’s increased control over the measuring de¬ 
vice means that in place of the losses the eavesdropper 
can simply instruct Bob’s device to give result 2 for both 
measurements. 

However, if we further verify that {'4’i\Ei\i\'tpi) = 1 — 
|('0i|V’2)|^ (a mild extension to the protocol in [17], which 
suggests throwing away some of the data needed to esti¬ 
mate this probability), then in fact Bob must be inducing 
the correct measurements. Since these measurements are 
incompatible, the parties have certified that the channel 


is not entanglement-breaking and there is hope for the 
protocol to be secure. A full security proof would of 
course require moving beyond the i.i.d. assumptions im¬ 
plicit in this discussion. 

V. CONCLUSIONS 

When translating EPR-steerability from bipartite 
states to channels the problem of joint measurability nat¬ 
urally emerges. I have outlined a few applications of this 
connection, in particular to define a resource theory of 
measurement incompatibility, but since the literatures on 
EPR-steering and joint measurability are both large there 
are bound to be many more. 

The security of BB84 with an untrusted measurement 
device is clarified by this perspective, in particular the 
definitions and results of m can be adapted to apply 
directly to the prepare-and-measure scenario. This also 
provides an uncertainty relation for ensembles. It may be 
fruitful to see if more powerful measurement uncertainty 
relations, such as those of [40], can also be adapted to 
arbitrary pairs of ensembles. Finally, it would be in¬ 
teresting to further investigate whether the conceptually 
important B92 protocol can also be secure with an un¬ 
trusted measurement device. 
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Appendix A: Proof of Theorem |3| 

The “if” direction is trivial. For the “only if” direc¬ 
tion, direction, suppose {Ei,\y\ can be converted into 
{7^b|y} by CNDO. That is, there exists a quantum in¬ 
strument {Ca} and probability distributions {p{y\y', a)}, 
{p{b'\b,a,y',y)} such that 

^b'\y- = X! ^l(^b\v)p{y\y', a)p{b'\b, a, y', y) (Al) 

a,y,b 

Since {Ffc/jj,/} and {E^y} are rank-one projectors, they 
can also be viewed as normalised quantum states. Hence 
the only difference between eq. ( |A1| ) and the correspond¬ 
ing EPR-steering problem is that Cj is not necessarily 
trace-preserving (but must be unital). However, the only 
properties of the corresponding maps used in the proof in 
Appendix D of |10j is complete positivity (in the form of 
the existence of a Kraus decomposition) and so the proof 
applies here as well. 


Appendix B: Translation guide for m 

Recall that we are interested in translating analyses 
from the form of eq. 0 to the form of eq. ( [T^ . We 
can bridge the gap somewhat by using the positive op¬ 
erator pABC Choi isomorphic to C, so that C{px\g) = 
Tya{pabcpI\s)- Then @ becomes 


.-S. Niu, and 

P i = — \ Tr ( 

(P^\Q 0 Frr\Q 0 Gt.\q) P A Rr*) 1 

arXiv:quant- 

9,x 

\r x\u X|C7 X 117 yAliD G.’ y 1 


which looks more like eq. (17). The two main differences 


to keep in mind are that is some unit trace op¬ 

erator, which may depend on 9, rather than I, and pabc 
has trace d (the dimension of Alice’s Hilbert space) rather 
than trace 1. 

With one exception, we can ignore the requirement 
on Choi states that Et:bc{pabc) = I because state¬ 
ments about all pabc will in particular be true about 
ones satisfying the constraint. It would be interesting to 
study whether using this constraint could lead to tighter 
bounds. 

In m frequent use is made of the “purification” of Bob 
and Charlie’s strategy. In our scenario that corresponds 
to dilating C into an isometry (giving the extra system 
to say, Charlie, who ignores it) and then purifying Bob 
and Charlie’s measurements as before. 

I will now outline the results of these techniques on the 
statements and proofs of the main theorems in m- 






The statement of theorem 3 of m, giving the op¬ 
timum winning probability for the “BB84 game”, sur¬ 
vives unscathed, except that the game is rescaled as 
Px\e = P ^\0 = The strategy used to show that 

the probability can be achieved does not translate into 
a valid channel (this is the “one exception” mentioned 
above). For n = 1 consider instead the channel that 
measures (((i| ,I — |0) (0|} and broadcasts the result 
0 or 1 to Bob and Charlie to use as their guesses. It is 
easy to see that this gives the same probability of success 
and for n > 1 it can be repeated n times. The proof of 
optimality is essentially unchanged, in Eq. (7) of [TT] we 
pick up a factor of 2" from the larger trace of pabc but 
it cancels with the rescaling of Px\e- 

Theorem 4 of which bounds the winning proba¬ 
bility of arbitrary games, can be converted into 


Theorem 5 of El, which concerns the security of an 
entangled-based variant of BB84 with an arbitrary mea¬ 
surement device for Bob, translates into a statement of 
the security of the original BB84 protocol with an arbi¬ 
trary measurement device. The state pqtxye is defined 
by Alice choosing a uniformly random 0 and preparing 
the n-qubit BB84 ensembles Px \0 = |a:®) {x^\ /2” with a 
classical record of the 9 and x stored in Alice’s registers 0 
and A", inputting the n qubits into an unknown channel 
to Bob and Eve, and then Alice announcing 9 to Bob so 
that he can perform the corresponding unknown POVM 
{Px\e} and store the result in Y. Since ^(Gggg^) = 2 
eq. (B2) gives Pwin(GBS 84 , 2”+^ q) < /3" exactly as in 
m- The remainder of the proof is unaltered. 

Finally, Theorem 8 of m, which provides an uncer¬ 
tainty relation, becomes a statement about 


Pwin(G"";Q)<|Q|d"(^^ + i^^V^) , 

(B2) 

where in addition to the usual maximal overlap 

c(G) = max max \\,/^^Px'\ 9 '\\ , (B3) 

e^e' 

we need the maximal probability 


PxBce = X! b {x\x®C{px\0) 0 \9) {9\q (B5) 

x,0 

for a channel C from A to BC and a pair of ensembles 
{Px\o\ and {px\i\ on the d-dimensional system A. The 
statement is that 

Pguess(-A|B0) + PgxLess{X\CQ) < d{m + y/c), (B6) 


mfG) = max max Trf 19 ^ 1 / 9 ) 


(B4) and 


The factor of d" comes from the trace of pabc- In 
the proof’s definition of A and B we can multiply I 7 -C 
by m(G)l^ I = m(G)”“‘ and still have B > A^^ and 
C > Af as required. This factor carries through to 
^/B^/C < m(G)"“*(A/c(G))‘ and ultimately into (B2). 


The transposes on p^ 


in eqs. (B3) and (B4) respectively. 


0 affect neither the norms nor traces 


id„,in(X|B0) +id^i„(X|C0) > -2 log 



where c 




yj Px\Q^ Pz\l 


(B7) 

and m = 


m.ayixfiAv{px\ 0 ). The d is from the normalization 
of the Choi state pabCi and the m is from strengthening 
||Af|| < 1 to \\Af\\ < m. 




















